diff --git a/agent/probes/network/src/tcp_netflow.bpf.c b/agent/probes/network/src/tcp_netflow.bpf.c index 7bc5c1ab71328467be1ea9d6083aed5cc6f7a674..8ba1eecfa3fa81c2758d3b1d3e5eaf9536f9b6de 100644 --- a/agent/probes/network/src/tcp_netflow.bpf.c +++ b/agent/probes/network/src/tcp_netflow.bpf.c @@ -191,4 +191,30 @@ int BPF_KRETPROBE(inet_csk_accept_exit, struct sock *ret) { tcpmetrics.role = LINK_ROLE_SERVER; bpf_map_update_elem(&tcp_link_map, &pid, &tcpmetrics, BPF_ANY); return 0; +} + +SEC("kprobe/tcp_v4_destroy_sock") +int BPF_KPROBE(tcp_v4_destroy_sock, struct sock *sk) { + u32 pid = bpf_get_current_pid_tgid() >> 32; + bpf_map_delete_elem(&tcp_link_map, &pid); + bpf_map_delete_elem(&tcp_link_map, &pid); + return 0; +} + +SEC("raw_tracepoint/tcp_destroy_sock") +int bpf_raw_trace_tcp_destroy_sock(struct bpf_raw_tracepoint_args *ctx) { + struct sock *sk = (struct sock *)ctx->args[0]; + u32 pid = bpf_get_current_pid_tgid() >> 32; + bpf_map_delete_elem(&tcp_link_map, &pid); + bpf_map_delete_elem(&tcp_link_map, &pid); + return 0; +} + +SEC("tracepoint/tcp/tcp_destroy_sock") +int bpf_trace_tcp_destroy_sock_func(struct trace_event_raw_tcp_event_sk *ctx) { + struct sock *sk = (struct sock *)ctx->skaddr; + u32 pid = bpf_get_current_pid_tgid() >> 32; + bpf_map_delete_elem(&tcp_link_map, &pid); + bpf_map_delete_elem(&tcp_link_map, &pid); + return 0; } \ No newline at end of file